]>
Commit | Line | Data |
---|---|---|
a68229f4 GKH |
1 | From 0dcd7876029b58770f769cbb7b484e88e4a305e5 Mon Sep 17 00:00:00 2001 |
2 | From: Greg Hackmann <ghackmann@google.com> | |
3 | Date: Wed, 7 Mar 2018 14:42:53 -0800 | |
4 | Subject: net: xfrm: use preempt-safe this_cpu_read() in ipcomp_alloc_tfms() | |
5 | ||
6 | From: Greg Hackmann <ghackmann@google.com> | |
7 | ||
8 | commit 0dcd7876029b58770f769cbb7b484e88e4a305e5 upstream. | |
9 | ||
10 | f7c83bcbfaf5 ("net: xfrm: use __this_cpu_read per-cpu helper") added a | |
11 | __this_cpu_read() call inside ipcomp_alloc_tfms(). | |
12 | ||
13 | At the time, __this_cpu_read() required the caller to either not care | |
14 | about races or to handle preemption/interrupt issues. 3.15 tightened | |
15 | the rules around some per-cpu operations, and now __this_cpu_read() | |
16 | should never be used in a preemptible context. On 3.15 and later, we | |
17 | need to use this_cpu_read() instead. | |
18 | ||
19 | syzkaller reported this leading to the following kernel BUG while | |
20 | fuzzing sendmsg: | |
21 | ||
22 | BUG: using __this_cpu_read() in preemptible [00000000] code: repro/3101 | |
23 | caller is ipcomp_init_state+0x185/0x990 | |
24 | CPU: 3 PID: 3101 Comm: repro Not tainted 4.16.0-rc4-00123-g86f84779d8e9 #154 | |
25 | Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014 | |
26 | Call Trace: | |
27 | dump_stack+0xb9/0x115 | |
28 | check_preemption_disabled+0x1cb/0x1f0 | |
29 | ipcomp_init_state+0x185/0x990 | |
30 | ? __xfrm_init_state+0x876/0xc20 | |
31 | ? lock_downgrade+0x5e0/0x5e0 | |
32 | ipcomp4_init_state+0xaa/0x7c0 | |
33 | __xfrm_init_state+0x3eb/0xc20 | |
34 | xfrm_init_state+0x19/0x60 | |
35 | pfkey_add+0x20df/0x36f0 | |
36 | ? pfkey_broadcast+0x3dd/0x600 | |
37 | ? pfkey_sock_destruct+0x340/0x340 | |
38 | ? pfkey_seq_stop+0x80/0x80 | |
39 | ? __skb_clone+0x236/0x750 | |
40 | ? kmem_cache_alloc+0x1f6/0x260 | |
41 | ? pfkey_sock_destruct+0x340/0x340 | |
42 | ? pfkey_process+0x62a/0x6f0 | |
43 | pfkey_process+0x62a/0x6f0 | |
44 | ? pfkey_send_new_mapping+0x11c0/0x11c0 | |
45 | ? mutex_lock_io_nested+0x1390/0x1390 | |
46 | pfkey_sendmsg+0x383/0x750 | |
47 | ? dump_sp+0x430/0x430 | |
48 | sock_sendmsg+0xc0/0x100 | |
49 | ___sys_sendmsg+0x6c8/0x8b0 | |
50 | ? copy_msghdr_from_user+0x3b0/0x3b0 | |
51 | ? pagevec_lru_move_fn+0x144/0x1f0 | |
52 | ? find_held_lock+0x32/0x1c0 | |
53 | ? do_huge_pmd_anonymous_page+0xc43/0x11e0 | |
54 | ? lock_downgrade+0x5e0/0x5e0 | |
55 | ? get_kernel_page+0xb0/0xb0 | |
56 | ? _raw_spin_unlock+0x29/0x40 | |
57 | ? do_huge_pmd_anonymous_page+0x400/0x11e0 | |
58 | ? __handle_mm_fault+0x553/0x2460 | |
59 | ? __fget_light+0x163/0x1f0 | |
60 | ? __sys_sendmsg+0xc7/0x170 | |
61 | __sys_sendmsg+0xc7/0x170 | |
62 | ? SyS_shutdown+0x1a0/0x1a0 | |
63 | ? __do_page_fault+0x5a0/0xca0 | |
64 | ? lock_downgrade+0x5e0/0x5e0 | |
65 | SyS_sendmsg+0x27/0x40 | |
66 | ? __sys_sendmsg+0x170/0x170 | |
67 | do_syscall_64+0x19f/0x640 | |
68 | entry_SYSCALL_64_after_hwframe+0x42/0xb7 | |
69 | RIP: 0033:0x7f0ee73dfb79 | |
70 | RSP: 002b:00007ffe14fc15a8 EFLAGS: 00000207 ORIG_RAX: 000000000000002e | |
71 | RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f0ee73dfb79 | |
72 | RDX: 0000000000000000 RSI: 00000000208befc8 RDI: 0000000000000004 | |
73 | RBP: 00007ffe14fc15b0 R08: 00007ffe14fc15c0 R09: 00007ffe14fc15c0 | |
74 | R10: 0000000000000000 R11: 0000000000000207 R12: 0000000000400440 | |
75 | R13: 00007ffe14fc16b0 R14: 0000000000000000 R15: 0000000000000000 | |
76 | ||
77 | Signed-off-by: Greg Hackmann <ghackmann@google.com> | |
78 | Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> | |
79 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | |
80 | ||
81 | --- | |
82 | net/xfrm/xfrm_ipcomp.c | 2 +- | |
83 | 1 file changed, 1 insertion(+), 1 deletion(-) | |
84 | ||
85 | --- a/net/xfrm/xfrm_ipcomp.c | |
86 | +++ b/net/xfrm/xfrm_ipcomp.c | |
87 | @@ -283,7 +283,7 @@ static struct crypto_comp * __percpu *ip | |
88 | struct crypto_comp *tfm; | |
89 | ||
90 | /* This can be any valid CPU ID so we don't need locking. */ | |
91 | - tfm = __this_cpu_read(*pos->tfms); | |
92 | + tfm = this_cpu_read(*pos->tfms); | |
93 | ||
94 | if (!strcmp(crypto_comp_name(tfm), alg_name)) { | |
95 | pos->users++; |